@cdot65/prisma-airs-sdk 0.18.0 → 0.20.0

package/dist/index.js

@@ -29,7 +29,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 20;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.17.0";
+var SDK_VERSION = "0.20.0";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -272,8 +272,8 @@ import { z as z15 } from "zod";
 // src/utils.ts
 import { createHmac } from "crypto";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function isValidUuid(value) {
-  return UUID_RE.test(value);
+function isValidUuid(value2) {
+  return UUID_RE.test(value2);
 }
 function generatePayloadHash(payload, secret) {
   return createHmac("sha256", secret).update(payload).digest("hex");
@@ -333,9 +333,9 @@ function extractErrorMessage(body, status) {
     return body ? `API error ${status}: ${body}` : `API error ${status}`;
   }
 }
-function parseRetryAfterHeader(value) {
-  if (value === null) return void 0;
-  const normalized = value.trim();
+function parseRetryAfterHeader(value2) {
+  if (value2 === null) return void 0;
+  const normalized = value2.trim();
   if (/^\d+$/.test(normalized)) {
     const milliseconds = Number(normalized) * 1e3;
     return Number.isFinite(milliseconds) ? milliseconds : void 0;
@@ -437,6 +437,120 @@ async function executeWithRetry(opts) {
 
 // src/http/debug.ts
 import { createHash } from "crypto";
+
+// src/ai-gateway/secret-fields.ts
+var AI_GATEWAY_REDACTED = "[REDACTED]";
+var value = (...path) => ({
+  path,
+  redact: "value"
+});
+var subtree = (...path) => ({
+  path,
+  redact: "subtree"
+});
+var oneTime = (...path) => ({
+  path,
+  redact: "value",
+  oneTime: true
+});
+var providerRequestSecrets = [
+  value("key"),
+  value("configurations", "azure_entra_client_secret"),
+  value("configurations", "aws_secret_access_key"),
+  subtree("configurations", "vertex_service_account_json"),
+  value("configurations", "custom_headers", "*")
+];
+var mcpRequestSecrets = [
+  value("configurations", "custom_headers", "*"),
+  value("configurations", "client_secret"),
+  value("configurations", "oauth_client_secret"),
+  subtree("configurations", "oauth_metadata")
+];
+var empty = [];
+var AI_GATEWAY_SECRET_FIELDS = {
+  "apiKeys.createService": { request: empty, response: [oneTime("key")] },
+  "apiKeys.createUser": { request: empty, response: [oneTime("key")] },
+  "apiKeys.rotateService": { request: empty, response: [oneTime("key")] },
+  "apiKeys.rotateUser": { request: empty, response: [oneTime("key")] },
+  "deployments.create": {
+    request: empty,
+    response: [oneTime("client_auth"), oneTime("credentials", "password")]
+  },
+  "deployments.update": {
+    request: empty,
+    response: [oneTime("client_auth"), oneTime("credentials", "password")]
+  },
+  "integrations.create": { request: providerRequestSecrets, response: empty },
+  "integrations.update": { request: providerRequestSecrets, response: empty },
+  "mcpIntegrations.create": { request: mcpRequestSecrets, response: empty },
+  "mcpIntegrations.update": { request: mcpRequestSecrets, response: empty },
+  "organisations.getAuthSettings": {
+    request: empty,
+    response: [value("scim_token"), value("data", "scim_token")]
+  },
+  "organisations.updateAuthSettings": {
+    request: [value("scim_token"), value("auth_settings", "client_secret")],
+    response: [value("scim_token"), value("data", "scim_token")]
+  },
+  "plugins.create": { request: [value("credentials", "*")], response: empty },
+  "providers.get": {
+    request: empty,
+    response: [
+      value("key"),
+      subtree("model_config"),
+      subtree("credentials"),
+      value("configurations", "azure_entra_client_secret"),
+      value("configurations", "aws_secret_access_key"),
+      subtree("configurations", "vertex_service_account_json"),
+      value("configurations", "custom_headers", "*")
+    ]
+  }
+};
+function cloneValue(input, seen = /* @__PURE__ */ new WeakMap()) {
+  if (typeof input !== "object" || input === null) return input;
+  const cached = seen.get(input);
+  if (cached !== void 0) return cached;
+  const output = Array.isArray(input) ? [] : {};
+  seen.set(input, output);
+  if (Array.isArray(input)) {
+    for (const item of input) output.push(cloneValue(item, seen));
+  } else {
+    for (const [key, item] of Object.entries(input)) {
+      Object.defineProperty(output, key, {
+        value: cloneValue(item, seen),
+        enumerable: true,
+        configurable: true,
+        writable: true
+      });
+    }
+  }
+  return output;
+}
+function applyRule(current, path, index) {
+  if (index === path.length) return AI_GATEWAY_REDACTED;
+  if (typeof current !== "object" || current === null) return current;
+  const segment = path[index];
+  if (Array.isArray(current)) {
+    if (segment !== "*") return current;
+    for (let i = 0; i < current.length; i++) current[i] = applyRule(current[i], path, index + 1);
+    return current;
+  }
+  const record = current;
+  if (segment === "*") {
+    for (const key of Object.keys(record)) record[key] = applyRule(record[key], path, index + 1);
+  } else if (Object.prototype.hasOwnProperty.call(record, segment)) {
+    record[segment] = applyRule(record[segment], path, index + 1);
+  }
+  return record;
+}
+function redactAIGatewaySecrets(operation, input, direction = "request") {
+  const output = cloneValue(input);
+  const metadata = AI_GATEWAY_SECRET_FIELDS[operation];
+  for (const rule of metadata[direction]) applyRule(output, rule.path, 0);
+  return output;
+}
+
+// src/http/debug.ts
 var TRUTHY = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
 var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([HEADER_AUTH_TOKEN.toLowerCase(), HEADER_API_KEY.toLowerCase()]);
 var PREFIX = "[airs-sdk]";
@@ -444,16 +558,23 @@ function isDebugEnabled() {
   const raw = process.env.PANW_AI_SEC_DEBUG;
   return raw !== void 0 && TRUTHY.has(raw.trim().toLowerCase());
 }
-function hashToken(value) {
-  return "sha256:" + createHash("sha256").update(value).digest("hex").slice(0, 12);
+function hashToken(value2) {
+  return "sha256:" + createHash("sha256").update(value2).digest("hex").slice(0, 12);
 }
 function sanitizeHeaders(headers) {
   const out = {};
-  for (const [key, value] of Object.entries(headers)) {
-    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value) : value;
+  for (const [key, value2] of Object.entries(headers)) {
+    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? hashToken(value2) : value2;
   }
   return out;
 }
+function sanitizeAIGatewayDebugBody(body, operation, direction) {
+  try {
+    return JSON.stringify(redactAIGatewaySecrets(operation, JSON.parse(body), direction));
+  } catch {
+    return "[BODY OMITTED: REDACTION FAILED]";
+  }
+}
 function logRequest(method, url, headers, body) {
   console.error(`${PREFIX} \u2192 ${method} ${url}`);
   console.error(`${PREFIX}   headers ${JSON.stringify(sanitizeHeaders(headers))}`);
@@ -465,6 +586,20 @@ function logResponse(status, ms, body) {
 
 // src/http/request.ts
 async function request(spec) {
+  let validatedBody = spec.body;
+  if (spec.requestSchema !== void 0) {
+    const result2 = spec.requestSchema.safeParse(spec.body);
+    if (!result2.success) {
+      const issues = result2.error.issues.map(
+        (issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`
+      ).join("; ");
+      throw new AISecSDKException(
+        `Request body for ${spec.method} ${spec.path} did not match schema: ${issues}`,
+        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
+      );
+    }
+    validatedBody = result2.data;
+  }
   let hasRetriedAuth = false;
   const debug = isDebugEnabled();
   const response = await executeWithRetry({
@@ -473,11 +608,11 @@ async function request(spec) {
       const baseUrl = spec.baseUrl.replace(/\/+$/, "");
       const url = new URL(`${baseUrl}${spec.path}`);
       if (spec.params) {
-        for (const [key, value] of Object.entries(spec.params)) {
-          if (Array.isArray(value)) {
-            for (const v of value) url.searchParams.append(key, v);
+        for (const [key, value2] of Object.entries(spec.params)) {
+          if (Array.isArray(value2)) {
+            for (const v of value2) url.searchParams.append(key, v);
           } else {
-            url.searchParams.set(key, value);
+            url.searchParams.set(key, value2);
           }
         }
       }
@@ -489,16 +624,19 @@ async function request(spec) {
       let bodyForFetch;
       if (spec.formData !== void 0) {
         bodyForFetch = spec.formData;
-      } else if (spec.body !== void 0) {
+      } else if (validatedBody !== void 0) {
         headers["Content-Type"] = spec.contentType ?? "application/json";
-        bodyText = JSON.stringify(spec.body);
+        bodyText = JSON.stringify(validatedBody);
         bodyForFetch = bodyText;
       }
       const prepared = { method: spec.method, url, headers, bodyText };
       const final = await spec.auth.prepare(prepared);
       const startedAt = debug ? Date.now() : 0;
       if (debug) {
-        const logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        let logBody = spec.formData !== void 0 ? "[multipart/form-data]" : final.bodyText;
+        if (logBody !== void 0 && spec.secretOperation !== void 0) {
+          logBody = sanitizeAIGatewayDebugBody(logBody, spec.secretOperation, "request");
+        }
         logRequest(final.method, final.url.toString(), final.headers, logBody);
       }
       const res = await fetch(final.url.toString(), {
@@ -510,6 +648,9 @@ async function request(spec) {
         let respBody;
         try {
           respBody = await res.clone().text();
+          if (respBody && spec.secretOperation !== void 0) {
+            respBody = sanitizeAIGatewayDebugBody(respBody, spec.secretOperation, "response");
+          }
         } catch {
         }
         logResponse(res.status, Date.now() - startedAt, respBody);
@@ -1163,14 +1304,14 @@ var Content = class _Content {
   get prompt() {
     return this._prompt;
   }
-  set prompt(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_PROMPT_LENGTH) {
+  set prompt(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_PROMPT_LENGTH) {
       throw new AISecSDKException(
         `prompt exceeds max length of ${MAX_CONTENT_PROMPT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._prompt = value;
+    this._prompt = value2;
   }
   /**
    * AI model response text. Setting a value validates its byte length (max 2 MB).
@@ -1185,14 +1326,14 @@ var Content = class _Content {
   get response() {
     return this._response;
   }
-  set response(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_RESPONSE_LENGTH) {
+  set response(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_RESPONSE_LENGTH) {
       throw new AISecSDKException(
         `response exceeds max length of ${MAX_CONTENT_RESPONSE_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._response = value;
+    this._response = value2;
   }
   /**
    * Conversation context. Setting a value validates its byte length (max 100 MB).
@@ -1207,14 +1348,14 @@ var Content = class _Content {
   get context() {
     return this._context;
   }
-  set context(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_CONTEXT_LENGTH) {
+  set context(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_CONTEXT_LENGTH) {
       throw new AISecSDKException(
         `context exceeds max length of ${MAX_CONTENT_CONTEXT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._context = value;
+    this._context = value2;
   }
   /**
    * Code prompt text. Setting a value validates its byte length (max 2 MB).
@@ -1229,14 +1370,14 @@ var Content = class _Content {
   get codePrompt() {
     return this._codePrompt;
   }
-  set codePrompt(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_PROMPT_LENGTH) {
+  set codePrompt(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_PROMPT_LENGTH) {
       throw new AISecSDKException(
         `codePrompt exceeds max length of ${MAX_CONTENT_PROMPT_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._codePrompt = value;
+    this._codePrompt = value2;
   }
   /**
    * Code response text. Setting a value validates its byte length (max 2 MB).
@@ -1251,14 +1392,14 @@ var Content = class _Content {
   get codeResponse() {
     return this._codeResponse;
   }
-  set codeResponse(value) {
-    if (value !== void 0 && Buffer.byteLength(value) > MAX_CONTENT_RESPONSE_LENGTH) {
+  set codeResponse(value2) {
+    if (value2 !== void 0 && Buffer.byteLength(value2) > MAX_CONTENT_RESPONSE_LENGTH) {
       throw new AISecSDKException(
         `codeResponse exceeds max length of ${MAX_CONTENT_RESPONSE_LENGTH} bytes`,
         "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
       );
     }
-    this._codeResponse = value;
+    this._codeResponse = value2;
   }
   /**
    * Tool/function call event data attached to the content.
@@ -1276,8 +1417,8 @@ var Content = class _Content {
   get toolEvent() {
     return this._toolEvent;
   }
-  set toolEvent(value) {
-    this._toolEvent = value;
+  set toolEvent(value2) {
+    this._toolEvent = value2;
   }
   /**
    * Total byte length of all text content fields.
@@ -2693,7 +2834,7 @@ var RuleEvaluationListSchema = z32.object({
 }).passthrough();
 var ViolationRemediationSchema = z32.object({
   steps: z32.array(z32.string()),
-  url: z32.string()
+  url: z32.string().optional()
 }).passthrough();
 var ViolationResponseSchema = z32.object({
   uuid: z32.string(),
@@ -2705,7 +2846,7 @@ var ViolationResponseSchema = z32.object({
   rule_name: z32.string(),
   rule_description: z32.string(),
   rule_instance_state: z32.string(),
-  remediation: ViolationRemediationSchema,
+  remediation: ViolationRemediationSchema.optional(),
   file: z32.string().nullable().optional(),
   hash: z32.string().nullable().optional(),
   module: z32.string().nullable().optional(),
@@ -2757,12 +2898,12 @@ var ListModelSecurityRulesResponseSchema = z32.object({
 var ModelSecurityRuleInstanceResponseSchema = z32.object({
   uuid: z32.string(),
   tsg_id: z32.string(),
-  created_at: z32.string(),
-  updated_at: z32.string(),
+  created_at: z32.string().optional(),
+  updated_at: z32.string().optional(),
   security_group_uuid: z32.string(),
-  security_rule_uuid: z32.string(),
+  security_rule_uuid: z32.string().optional(),
   state: z32.string(),
-  rule: ModelSecurityRuleResponseSchema,
+  rule: ModelSecurityRuleResponseSchema.optional(),
   field_values: z32.record(z32.unknown()).optional()
 }).passthrough();
 var ModelSecurityRuleInstanceUpdateRequestSchema = z32.object({
@@ -4443,6 +4584,11 @@ var GatewayConfigDetailSchema = GatewayConfigSchema.extend({
   type: z35.string(),
   version_id: z35.string()
 }).passthrough();
+var GatewayConfigVersionSchema = GatewayConfigDetailSchema.extend({
+  version_created_at: z35.string(),
+  version_owner_id: z35.string()
+}).passthrough();
+var ListConfigVersionsResponseSchema = aiGatewayList(GatewayConfigVersionSchema);
 var GatewayConfigCreateResponseSchema = z35.object({
   id: z35.string(),
   version_id: z35.string(),
@@ -4480,8 +4626,8 @@ var GatewayGuardrailDetailSchema = GatewayGuardrailSchema.extend({
     async: z35.boolean(),
     sequential: z35.boolean(),
     /** Absent when the guardrail was created without a pass/fail feedback action. */
-    on_success: guardrailFeedbackActionSchema.optional(),
-    on_fail: guardrailFeedbackActionSchema.optional()
+    on_success: guardrailFeedbackActionSchema.nullable().optional(),
+    on_fail: guardrailFeedbackActionSchema.nullable().optional()
   }).passthrough(),
   version_id: z35.string()
 }).passthrough();
@@ -4498,6 +4644,27 @@ var GatewayProviderSchema = z35.object({
   object: z35.string().optional()
 }).passthrough();
 var ListProvidersResponseSchema = aiGatewayList(GatewayProviderSchema);
+var GatewayProviderDetailSchema = z35.object({
+  id: z35.string(),
+  ai_provider_name: z35.string(),
+  model_config: z35.record(z35.unknown()),
+  /** Potentially secret-bearing. Never log or persist this field. */
+  key: z35.string(),
+  masked_api_key: z35.string(),
+  slug: z35.string(),
+  name: z35.string(),
+  usage_limits: z35.unknown().nullable(),
+  status: z35.string(),
+  note: z35.string().nullable(),
+  created_at: z35.string(),
+  expires_at: z35.string().nullable(),
+  last_reset_at: z35.string().nullable(),
+  rate_limits: z35.array(z35.unknown()),
+  integration_id: z35.string(),
+  tags: z35.unknown().nullable(),
+  secret_mappings: z35.array(z35.unknown()).optional(),
+  object: z35.string()
+}).passthrough();
 var GatewayProviderCreateResponseSchema = z35.object({
   id: z35.string(),
   slug: z35.string(),
@@ -4509,6 +4676,11 @@ var GatewayApiKeySchema = z35.object({
   object: z35.string().optional()
 }).passthrough();
 var ListApiKeysResponseSchema = aiGatewayList(GatewayApiKeySchema);
+var GatewayApiKeyRotateResponseSchema = z35.object({
+  id: z35.string(),
+  key: z35.string(),
+  key_transition_expires_at: z35.string()
+}).passthrough();
 var GatewayIntegrationSchema = z35.object({
   id: z35.string(),
   organisation_id: z35.string().optional(),
@@ -4539,7 +4711,7 @@ var GatewayIntegrationWorkspaceSchema = z35.object({
   enabled: z35.boolean(),
   status: z35.string(),
   created_at: z35.string(),
-  last_updated_at: z35.string(),
+  last_updated_at: z35.string().nullable(),
   last_reset_at: z35.string().nullable()
 }).passthrough();
 var GatewayGlobalWorkspaceAccessSchema = z35.object({
@@ -4572,6 +4744,70 @@ var McpIntegrationSchema = z35.object({
   last_updated_at: z35.string()
 }).passthrough();
 var ListMcpIntegrationsResponseSchema = aiGatewayList(McpIntegrationSchema);
+var McpIntegrationDetailSchema = z35.object({
+  id: z35.string(),
+  name: z35.string(),
+  description: z35.string().nullable(),
+  owner_id: z35.string(),
+  status: z35.string(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  configurations: z35.record(z35.unknown()),
+  global_workspace_access: z35.object({ enabled: z35.boolean() }).passthrough().nullable(),
+  workspace_id: z35.string().nullable(),
+  slug: z35.string(),
+  url: z35.string(),
+  auth_type: z35.string(),
+  transport: z35.string(),
+  type: z35.string(),
+  secret_mappings: z35.array(z35.unknown()).nullable(),
+  object: z35.string()
+}).passthrough();
+var McpCapabilityCountSchema = z35.object({ total: z35.number(), enabled: z35.number() }).passthrough();
+var McpIntegrationCapabilitySchema = z35.object({
+  name: z35.string(),
+  type: z35.string(),
+  title: z35.string().nullable(),
+  description: z35.string().nullable(),
+  icons: z35.unknown().nullable(),
+  enabled: z35.boolean(),
+  created_at: z35.string(),
+  last_updated_at: z35.string(),
+  input_schema: z35.record(z35.unknown()).nullable(),
+  output_schema: z35.record(z35.unknown()).nullable(),
+  execution: z35.unknown().nullable(),
+  annotations: z35.record(z35.unknown()).nullable(),
+  object: z35.string()
+}).passthrough();
+var McpIntegrationCapabilitiesResponseSchema = z35.object({
+  object: z35.string(),
+  counts: z35.object({
+    tools: McpCapabilityCountSchema.optional(),
+    prompts: McpCapabilityCountSchema.optional(),
+    resources: McpCapabilityCountSchema.optional(),
+    resource_templates: McpCapabilityCountSchema.optional()
+  }).passthrough(),
+  total: z35.number(),
+  has_more: z35.boolean(),
+  data: z35.array(McpIntegrationCapabilitySchema)
+}).passthrough();
+var McpIntegrationCapabilitiesUpdateResponseSchema = z35.object({ success: z35.boolean() }).passthrough();
+var McpIntegrationWorkspacesUpdateResponseSchema = z35.object({}).strict();
+var McpIntegrationMetadataSchema = z35.object({
+  server_name: z35.string(),
+  server_version: z35.string(),
+  title: z35.string().nullable(),
+  description: z35.string().nullable(),
+  website_url: z35.string().nullable(),
+  icons: z35.unknown().nullable(),
+  protocol_version: z35.string().nullable(),
+  capability_flags: z35.record(z35.unknown()),
+  instructions: z35.string().nullable(),
+  sync_status: z35.string(),
+  last_synced_at: z35.string().nullable(),
+  sync_error: z35.string().nullable(),
+  object: z35.string()
+}).passthrough();
 var GatewayDeploymentSchema = z35.object({
   id: z35.string(),
   name: z35.string(),
@@ -4607,6 +4843,18 @@ var GatewayDeploymentCreateResponseSchema = z35.object({
   organisation_id: z35.string(),
   object: z35.string()
 }).passthrough();
+var GatewayDeploymentPingResponseSchema = z35.object({
+  status: z35.string(),
+  gateway_base_url: z35.string(),
+  outbound: z35.object({
+    status: z35.string(),
+    status_code: z35.number().optional(),
+    version: z35.string().optional(),
+    error: z35.string().optional()
+  }).passthrough(),
+  inbound: z35.object({ status: z35.string(), error: z35.string().optional() }).passthrough(),
+  object: z35.string()
+}).passthrough();
 var ListDeploymentsResponseSchema = aiGatewayList(GatewayDeploymentSchema);
 var GatewayPluginSchema = z35.object({
   id: z35.string(),
@@ -4644,6 +4892,472 @@ var GatewayAuditLogRecordSchema = z35.object({
 }).passthrough();
 var GatewayAuditLogsResponseSchema = z35.object({ records: z35.array(GatewayAuditLogRecordSchema) }).passthrough();
 
+// src/models/ai-gateway-routing.ts
+import { z as z36 } from "zod";
+var AI_GATEWAY_DEPLOYMENT_TYPES = ["non_production", "production"];
+var GatewayDeploymentTypeSchema = z36.enum(AI_GATEWAY_DEPLOYMENT_TYPES);
+var AI_GATEWAY_DEPLOYMENT_STATUSES = ["active", "archived"];
+var GatewayDeploymentStatusSchema = z36.enum(AI_GATEWAY_DEPLOYMENT_STATUSES);
+var AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES = ["prompt", "resource", "tool"];
+var GatewayMutableMcpCapabilityTypeSchema = z36.enum(
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES
+);
+var AI_GATEWAY_KNOWN_API_KEY_SCOPES = [
+  "agents.invoke",
+  "completions.write",
+  "logs.write",
+  "mcp.invoke",
+  "prompts.render"
+];
+var AI_GATEWAY_KNOWN_CACHE_MODES = ["semantic", "simple"];
+var AI_GATEWAY_KNOWN_CONFIG_STRATEGIES = ["fallback", "loadbalance", "single"];
+var AI_GATEWAY_KNOWN_MCP_AUTH_TYPES = [
+  "headers",
+  "none",
+  "oauth_auto",
+  "oauth_client_credentials"
+];
+var AI_GATEWAY_KNOWN_MCP_TRANSPORTS = ["http", "interactive", "sse"];
+var AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES = ["requests", "tokens"];
+var AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS = ["rpd", "rph", "rpm", "rps", "rpw"];
+var openValue = () => z36.string().min(1);
+var GatewayApiKeyScopeSchema = openValue();
+var GatewayConfigCacheModeSchema = openValue();
+var GatewayConfigStrategySchema = openValue();
+var GatewayMcpAuthTypeSchema = openValue();
+var GatewayMcpTransportSchema = openValue();
+var GatewayRateLimitTypeSchema = openValue();
+var GatewayRateLimitUnitSchema = openValue();
+var unsafeJsonKeys = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function isFiniteJsonValue(value2, ancestors = /* @__PURE__ */ new WeakSet()) {
+  if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean" || typeof value2 === "number" && Number.isFinite(value2)) {
+    return true;
+  }
+  if (typeof value2 !== "object" || ancestors.has(value2)) return false;
+  if (Array.isArray(value2)) {
+    const keys = Object.keys(value2);
+    if (keys.length !== value2.length || keys.some((key, index) => key !== String(index)) || Object.getOwnPropertySymbols(value2).length > 0) {
+      return false;
+    }
+    ancestors.add(value2);
+    const valid2 = value2.every((item) => isFiniteJsonValue(item, ancestors));
+    ancestors.delete(value2);
+    return valid2;
+  }
+  const prototype = Object.getPrototypeOf(value2);
+  if (prototype !== Object.prototype && prototype !== null) return false;
+  if (Object.getOwnPropertySymbols(value2).length > 0) return false;
+  ancestors.add(value2);
+  const valid = Object.entries(Object.getOwnPropertyDescriptors(value2)).every(
+    ([key, descriptor]) => descriptor.enumerable === true && "value" in descriptor && !unsafeJsonKeys.has(key) && isFiniteJsonValue(descriptor.value, ancestors)
+  );
+  ancestors.delete(value2);
+  return valid;
+}
+var GatewayJsonValueSchema = z36.custom(
+  (value2) => isFiniteJsonValue(value2),
+  "Expected a finite, prototype-safe JSON value"
+);
+var GatewayJsonObjectSchema = z36.custom(
+  (value2) => typeof value2 === "object" && value2 !== null && !Array.isArray(value2) && isFiniteJsonValue(value2),
+  "Expected a finite, prototype-safe JSON object"
+);
+var GatewayRoutingRetrySchema = z36.object({
+  attempts: z36.number().int().min(0).optional(),
+  on_status_codes: z36.array(z36.number().int().min(100).max(599)).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingCacheSchema = z36.object({
+  mode: GatewayConfigCacheModeSchema.optional(),
+  max_age: z36.number().int().min(0).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingStrategySchema = z36.object({ mode: GatewayConfigStrategySchema }).catchall(GatewayJsonValueSchema);
+var GatewayRoutingTargetSchema = z36.object({
+  provider: z36.string().min(1).optional(),
+  virtual_key: z36.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayRoutingConfigSchema = z36.object({
+  retry: GatewayRoutingRetrySchema.optional(),
+  cache: GatewayRoutingCacheSchema.optional(),
+  strategy: GatewayRoutingStrategySchema.optional(),
+  targets: z36.array(GatewayRoutingTargetSchema).optional(),
+  provider: z36.string().min(1).optional(),
+  virtual_key: z36.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayOpenAIConfigurationSchema = z36.object({
+  openai_organization: z36.string().min(1).optional(),
+  openai_project: z36.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayAzureDeploymentConfigurationSchema = z36.object({
+  alias: z36.string().min(1).optional(),
+  azure_api_version: z36.string().min(1).max(30),
+  azure_deployment_name: z36.string().min(1),
+  is_default: z36.boolean().optional(),
+  azure_model_slug: z36.string().min(1)
+}).catchall(GatewayJsonValueSchema);
+var azureAuthModeSchema = z36.enum(["default", "entra", "managed"]);
+var GatewayAzureOpenAIConfigurationSchema = z36.object({
+  azure_auth_mode: azureAuthModeSchema,
+  azure_resource_name: z36.string().min(1),
+  azure_deployment_config: z36.array(GatewayAzureDeploymentConfigurationSchema).min(1),
+  azure_entra_tenant_id: z36.string().min(1).optional(),
+  azure_entra_client_id: z36.string().min(1).optional(),
+  azure_entra_client_secret: z36.string().min(1).optional(),
+  azure_managed_client_id: z36.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayBedrockConfigurationSchema = z36.object({
+  aws_auth_type: z36.enum(["accessKey", "assumedRole"]),
+  aws_region: z36.string().min(1),
+  aws_access_key_id: z36.string().min(1).optional(),
+  aws_secret_access_key: z36.string().min(1).optional(),
+  aws_role_arn: z36.string().min(1).optional(),
+  aws_external_id: z36.string().min(1).nullable().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewaySageMakerConfigurationSchema = GatewayBedrockConfigurationSchema.extend({
+  amzn_sagemaker_custom_attributes: z36.string().optional(),
+  amzn_sagemaker_target_model: z36.string().optional(),
+  amzn_sagemaker_target_variant: z36.string().optional(),
+  amzn_sagemaker_target_container_hostname: z36.string().optional(),
+  amzn_sagemaker_inference_id: z36.string().optional(),
+  amzn_sagemaker_enable_explanations: z36.string().optional(),
+  amzn_sagemaker_inference_component: z36.string().optional(),
+  amzn_sagemaker_session_id: z36.string().optional(),
+  amzn_sagemaker_model_name: z36.string().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayVertexAIConfigurationSchema = z36.object({
+  vertex_auth_type: z36.enum(["basic", "serviceAccount"]),
+  vertex_region: z36.string().min(1),
+  vertex_project_id: z36.string().min(1).optional(),
+  vertex_service_account_json: GatewayJsonObjectSchema.optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayAzureAIConfigurationSchema = z36.object({
+  azure_auth_mode: azureAuthModeSchema,
+  azure_foundry_url: z36.string().url(),
+  azure_api_version: z36.string().min(1).max(30).optional(),
+  azure_deployment_name: z36.string().min(1).optional(),
+  azure_entra_tenant_id: z36.string().min(1).optional(),
+  azure_entra_client_id: z36.string().min(1).optional(),
+  azure_entra_client_secret: z36.string().min(1).optional(),
+  azure_managed_client_id: z36.string().min(1).optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewayWorkersAIConfigurationSchema = z36.object({ workers_ai_account_id: z36.string().min(1) }).catchall(GatewayJsonValueSchema);
+var GatewayHuggingFaceConfigurationSchema = z36.object({ huggingface_base_url: z36.string().url().optional() }).catchall(GatewayJsonValueSchema);
+var GatewayCortexConfigurationSchema = z36.object({ snowflake_account: z36.string().min(1) }).catchall(GatewayJsonValueSchema);
+var GatewayCustomHostConfigurationSchema = z36.object({
+  custom_host: z36.string().url().optional(),
+  custom_headers: z36.record(z36.string()).optional()
+}).catchall(GatewayJsonValueSchema);
+
+// src/models/ai-gateway-requests.ts
+import { z as z37 } from "zod";
+var nonEmptyString = z37.string().min(1);
+var uuid = z37.string().uuid();
+var numericId = z37.string().regex(/^\d+$/, "Expected a numeric-string TSG id");
+var workspaceRef = z37.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+var dateTime = z37.string().datetime({ offset: true });
+var nonEmptyObject = (schema, message = "Provide at least one field") => schema.refine((body) => Object.keys(body).length > 0, { message });
+var GatewayRateLimitInputSchema = z37.object({
+  type: GatewayRateLimitTypeSchema,
+  unit: GatewayRateLimitUnitSchema,
+  value: z37.number().int().min(0)
+}).strict();
+var GatewayUsageLimitInputSchema = nonEmptyObject(
+  z37.object({
+    credit_limit: z37.number().min(0).optional(),
+    type: z37.enum(["cost", "tokens"]).optional(),
+    alert_threshold: z37.number().min(0).optional(),
+    periodic_reset: z37.enum(["monthly", "weekly"]).nullable().optional(),
+    periodic_reset_days: z37.number().int().min(1).max(365).nullable().optional(),
+    next_usage_reset_at: dateTime.nullable().optional()
+  }).strict()
+).refine(
+  (value2) => value2.periodic_reset == null || value2.periodic_reset_days == null,
+  "periodic_reset and periodic_reset_days are mutually exclusive"
+);
+var GatewayDefaultsInputSchema = z37.object({
+  metadata: z37.record(GatewayJsonValueSchema).optional(),
+  config_id: nonEmptyString.optional(),
+  allow_config_override: z37.boolean().optional()
+}).catchall(GatewayJsonValueSchema);
+var GatewaySecretMappingSchema = z37.object({
+  target_field: nonEmptyString,
+  secret_reference_id: nonEmptyString,
+  secret_key: nonEmptyString.nullable().optional(),
+  value_format: z37.enum(["json", "string"]).nullable().optional()
+}).strict();
+var GatewayGlobalWorkspaceAccessInputSchema = z37.object({
+  enabled: z37.boolean(),
+  usage_limits: z37.array(GatewayUsageLimitInputSchema).max(1).nullable().optional(),
+  rate_limits: z37.array(GatewayRateLimitInputSchema).max(1).nullable().optional()
+}).strict();
+var GatewayWorkspaceBindingSchema = z37.object({
+  id: workspaceRef,
+  enabled: z37.boolean(),
+  usage_limits: z37.array(GatewayUsageLimitInputSchema).max(1).nullable().optional(),
+  rate_limits: z37.array(GatewayRateLimitInputSchema).max(1).nullable().optional(),
+  reset_usage: z37.boolean().optional(),
+  create_default_provider: z37.boolean().optional(),
+  default_provider_slug: nonEmptyString.optional()
+}).strict();
+var GatewayWorkspaceCreateRequestSchema = z37.object({
+  name: nonEmptyString,
+  scope_name: nonEmptyString,
+  description: z37.string().optional(),
+  icon: z37.string().optional(),
+  defaults: GatewayDefaultsInputSchema.optional(),
+  users: z37.array(nonEmptyString).optional(),
+  usage_limits: z37.array(GatewayUsageLimitInputSchema).optional(),
+  rate_limits: z37.array(GatewayRateLimitInputSchema).optional()
+}).strict();
+var GatewayWorkspaceUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    name: nonEmptyString.optional(),
+    description: z37.string().optional(),
+    icon: z37.string().optional(),
+    defaults: GatewayDefaultsInputSchema.optional(),
+    usage_limits: z37.array(GatewayUsageLimitInputSchema).optional(),
+    rate_limits: z37.array(GatewayRateLimitInputSchema).optional()
+  }).strict()
+);
+var GatewayConfigCreateRequestSchema = z37.object({
+  name: nonEmptyString,
+  workspace_id: uuid,
+  config: GatewayRoutingConfigSchema
+}).strict();
+var GatewayConfigUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    name: nonEmptyString.optional(),
+    workspace_id: uuid.optional(),
+    config: GatewayRoutingConfigSchema.optional(),
+    status: nonEmptyString.optional()
+  }).strict()
+);
+var GatewayGuardrailCheckSchema = z37.object({
+  id: nonEmptyString,
+  parameters: GatewayJsonObjectSchema.optional(),
+  is_enabled: z37.boolean().optional(),
+  name: nonEmptyString.optional()
+}).strict();
+var feedbackSchema = z37.object({
+  value: z37.number(),
+  weight: z37.number(),
+  metadata: z37.string()
+}).catchall(GatewayJsonValueSchema);
+var actionResultSchema = z37.object({ feedback: feedbackSchema.optional() }).catchall(GatewayJsonValueSchema);
+var GatewayGuardrailActionsSchema = nonEmptyObject(
+  z37.object({
+    deny: z37.boolean().optional(),
+    async: z37.boolean().optional(),
+    on_success: actionResultSchema.optional(),
+    on_fail: actionResultSchema.optional()
+  }).catchall(GatewayJsonValueSchema)
+);
+var GatewayGuardrailCreateRequestSchema = z37.object({
+  workspace_id: uuid,
+  name: nonEmptyString,
+  checks: z37.array(GatewayGuardrailCheckSchema).min(1),
+  actions: GatewayGuardrailActionsSchema
+}).strict();
+var GatewayGuardrailUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    name: nonEmptyString.optional(),
+    checks: z37.array(GatewayGuardrailCheckSchema).min(1).optional(),
+    actions: GatewayGuardrailActionsSchema.optional()
+  }).strict()
+);
+var GatewayProviderCreateRequestSchema = z37.object({
+  workspace_id: uuid,
+  ai_provider_id: uuid,
+  name: nonEmptyString,
+  integration_id: uuid,
+  slug: nonEmptyString,
+  note: z37.string().nullable().optional(),
+  usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+  rate_limits: GatewayRateLimitInputSchema.nullable().optional(),
+  expires_at: dateTime.nullable().optional()
+}).strict();
+var GatewayProviderUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    name: nonEmptyString.optional(),
+    note: z37.string().nullable().optional(),
+    usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+    rate_limits: GatewayRateLimitInputSchema.nullable().optional(),
+    expires_at: dateTime.nullable().optional(),
+    reset_usage: z37.boolean().optional()
+  }).strict()
+);
+var GatewayApiKeyRotationPolicySchema = nonEmptyObject(
+  z37.object({
+    rotation_period: z37.enum(["monthly", "weekly"]).nullable().optional(),
+    next_rotation_at: dateTime.nullable().optional(),
+    key_transition_period_ms: z37.number().int().min(18e5).optional()
+  }).strict()
+).refine(
+  (value2) => value2.rotation_period == null || value2.next_rotation_at == null,
+  "rotation_period and next_rotation_at are mutually exclusive"
+);
+var apiKeyMutableFields = {
+  name: nonEmptyString,
+  description: z37.string().optional(),
+  scopes: z37.array(GatewayApiKeyScopeSchema).min(1),
+  rate_limits: z37.array(GatewayRateLimitInputSchema).nullable().optional(),
+  usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+  defaults: GatewayDefaultsInputSchema.nullable().optional(),
+  alert_emails: z37.array(z37.string().email()).optional(),
+  expires_at: dateTime.nullable().optional(),
+  rotation_policy: GatewayApiKeyRotationPolicySchema.nullable().optional()
+};
+var serviceApiKeyCreateFields = {
+  ...apiKeyMutableFields,
+  organisation_id: numericId,
+  workspace_id: uuid,
+  type: nonEmptyString
+};
+var GatewayServiceApiKeyCreateRequestSchema = z37.object(serviceApiKeyCreateFields).strict();
+var GatewayUserApiKeyCreateRequestSchema = z37.object({ ...serviceApiKeyCreateFields, user_id: uuid }).strict();
+var GatewayApiKeyCreateRequestSchema = z37.union([
+  GatewayUserApiKeyCreateRequestSchema,
+  GatewayServiceApiKeyCreateRequestSchema
+]);
+var GatewayApiKeyUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    name: nonEmptyString.optional(),
+    description: z37.string().optional(),
+    scopes: z37.array(GatewayApiKeyScopeSchema).min(1).optional(),
+    rate_limits: z37.array(GatewayRateLimitInputSchema).nullable().optional(),
+    usage_limits: GatewayUsageLimitInputSchema.nullable().optional(),
+    reset_usage: z37.boolean().optional(),
+    defaults: GatewayDefaultsInputSchema.nullable().optional(),
+    alert_emails: z37.array(z37.string().email()).optional(),
+    expires_at: dateTime.nullable().optional(),
+    rotation_policy: GatewayApiKeyRotationPolicySchema.nullable().optional()
+  }).strict()
+);
+var GatewayApiKeyRotateRequestSchema = z37.object({ key_transition_period_ms: z37.number().int().min(18e5).optional() }).strict();
+var GatewayIntegrationCreateRequestSchema = z37.object({
+  organisation_id: numericId,
+  ai_provider_id: uuid,
+  name: nonEmptyString,
+  slug: nonEmptyString,
+  description: z37.string().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  key: nonEmptyString.optional(),
+  secret_mappings: z37.array(GatewaySecretMappingSchema).optional()
+}).strict();
+var GatewayIntegrationUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    name: nonEmptyString.optional(),
+    description: z37.string().optional(),
+    configurations: GatewayJsonObjectSchema.optional(),
+    key: nonEmptyString.optional(),
+    secret_mappings: z37.array(GatewaySecretMappingSchema).optional()
+  }).strict()
+);
+var GatewayIntegrationModelUpdateSchema = z37.object({
+  slug: nonEmptyString,
+  enabled: z37.boolean(),
+  is_custom: z37.boolean().nullable().optional(),
+  is_finetune: z37.boolean().nullable().optional(),
+  base_model_slug: nonEmptyString.nullable().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  pricing_config: GatewayJsonObjectSchema.optional()
+}).strict();
+var GatewayIntegrationModelsBulkUpdateRequestSchema = z37.object({
+  models: z37.array(GatewayIntegrationModelUpdateSchema).min(1),
+  allow_all_models: z37.boolean().optional()
+}).strict();
+var GatewayIntegrationWorkspacesBulkUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    workspaces: z37.array(GatewayWorkspaceBindingSchema).optional(),
+    global_workspace_access: GatewayGlobalWorkspaceAccessInputSchema.optional(),
+    override_existing_workspace_access: z37.boolean().optional(),
+    create_default_provider: z37.boolean().optional(),
+    default_provider_slug: nonEmptyString.optional()
+  }).strict()
+);
+var McpIntegrationCreateRequestSchema = z37.object({
+  name: nonEmptyString,
+  organisation_id: numericId,
+  slug: nonEmptyString,
+  url: z37.string().url(),
+  auth_type: GatewayMcpAuthTypeSchema,
+  transport: GatewayMcpTransportSchema,
+  description: z37.string().nullable().optional(),
+  configurations: GatewayJsonObjectSchema.optional(),
+  secret_mappings: z37.array(GatewaySecretMappingSchema).optional()
+}).strict();
+var McpIntegrationUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    name: nonEmptyString.optional(),
+    description: z37.string().nullable().optional(),
+    configurations: GatewayJsonObjectSchema.optional(),
+    url: z37.string().url().optional(),
+    auth_type: GatewayMcpAuthTypeSchema.optional(),
+    transport: GatewayMcpTransportSchema.optional(),
+    secret_mappings: z37.array(GatewaySecretMappingSchema).optional()
+  }).strict()
+);
+var McpIntegrationCapabilityUpdateSchema = z37.object({
+  name: nonEmptyString,
+  type: GatewayMutableMcpCapabilityTypeSchema,
+  enabled: z37.boolean()
+}).strict();
+var McpIntegrationCapabilitiesBulkUpdateRequestSchema = z37.object({ capabilities: z37.array(McpIntegrationCapabilityUpdateSchema).min(1) }).strict();
+var McpIntegrationWorkspacesBulkUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    workspaces: z37.array(z37.object({ id: workspaceRef, enabled: z37.boolean() }).strict()).optional(),
+    global_workspace_access: z37.object({ enabled: z37.boolean() }).strict().nullable().optional(),
+    override_existing_workspace_access: z37.boolean().optional()
+  }).strict()
+);
+var GatewayDeploymentAuthSettingsInputSchema = z37.object({
+  gateway_base_url: z37.string().url().optional(),
+  mcp_gateway_base_url: z37.string().url().optional(),
+  is_dataservice_hosted: z37.union([z37.literal(0), z37.literal(1)]).optional(),
+  is_playground_proxy_allowed: z37.union([z37.literal(0), z37.literal(1)]).optional(),
+  workspaces_allowed: z37.array(workspaceRef).optional(),
+  jwt_subs_allowed: z37.array(nonEmptyString).optional(),
+  jwt_sub_workspace_mapping: z37.record(workspaceRef).optional(),
+  allow_all_workspaces: z37.boolean().optional(),
+  remove_workspaces_allowed: z37.array(workspaceRef).optional(),
+  remove_subs_allowed: z37.array(nonEmptyString).optional()
+}).strict();
+var GatewayDeploymentCreateRequestSchema = z37.object({
+  name: nonEmptyString,
+  type: GatewayDeploymentTypeSchema,
+  organisation_id: numericId,
+  auth_settings: GatewayDeploymentAuthSettingsInputSchema.optional(),
+  deployment_config: GatewayJsonObjectSchema.optional(),
+  is_default: z37.boolean().optional(),
+  slug: nonEmptyString.optional()
+}).strict();
+var GatewayDeploymentUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    name: nonEmptyString.optional(),
+    type: GatewayDeploymentTypeSchema.optional(),
+    status: GatewayDeploymentStatusSchema.optional(),
+    deployment_config: GatewayJsonObjectSchema.nullable().optional(),
+    is_default: z37.boolean().optional(),
+    rotate_auth: z37.boolean().optional(),
+    override_existing: z37.boolean().optional(),
+    auth_settings: GatewayDeploymentAuthSettingsInputSchema.optional()
+  }).strict()
+);
+var GatewayPluginCreateRequestSchema = z37.object({
+  organisation_id: numericId,
+  integration_id: uuid,
+  credentials: z37.record(z37.string().min(1)).refine((value2) => Object.keys(value2).length > 0)
+}).strict();
+var GatewayOrganisationUpdateRequestSchema = nonEmptyObject(
+  z37.object({ name: nonEmptyString.optional() }).catchall(GatewayJsonValueSchema)
+);
+var GatewayOrganisationAuthSettingsUpdateRequestSchema = nonEmptyObject(
+  z37.object({
+    auth_settings: GatewayJsonObjectSchema.optional(),
+    domains: z37.array(nonEmptyString).optional(),
+    scim_token: nonEmptyString.optional()
+  }).catchall(GatewayJsonValueSchema)
+);
+
 // src/http/auth/oauth.ts
 var OAuthAuth = class {
   constructor(oauthClient) {
@@ -4666,12 +5380,12 @@ var OAuthAuth = class {
 };
 
 // src/models/oauth-token.ts
-import { z as z36 } from "zod";
-var OAuthTokenResponseSchema = z36.object({
-  access_token: z36.string(),
-  token_type: z36.string().optional(),
-  expires_in: z36.number(),
-  scope: z36.string().optional()
+import { z as z38 } from "zod";
+var OAuthTokenResponseSchema = z38.object({
+  access_token: z38.string(),
+  token_type: z38.string().optional(),
+  expires_in: z38.number(),
+  scope: z38.string().optional()
 }).passthrough();
 
 // src/management/oauth-client.ts
@@ -4889,26 +5603,26 @@ function resolveOAuthConfig(opts) {
 }
 
 // src/validators.ts
-function assertUuid(value, fieldName) {
-  if (!isValidUuid(value)) {
+function assertUuid(value2, fieldName) {
+  if (!isValidUuid(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value}`,
+      `Invalid ${fieldName}: ${value2}`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
 }
-function assertWorkspaceRef(value, fieldName) {
-  if (!isValidUuid(value) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value)) {
+function assertWorkspaceRef(value2, fieldName) {
+  if (!isValidUuid(value2) && !/^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value} (expected a workspace UUID or slug)`,
+      `Invalid ${fieldName}: ${value2} (expected a workspace UUID or slug)`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
 }
-function assertNumericId(value, fieldName) {
-  if (!/^\d+$/.test(value)) {
+function assertNumericId(value2, fieldName) {
+  if (!/^\d+$/.test(value2)) {
     throw new AISecSDKException(
-      `Invalid ${fieldName}: ${value}`,
+      `Invalid ${fieldName}: ${value2}`,
       "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
     );
   }
@@ -5777,7 +6491,7 @@ var ScanLogsClient = class {
 };
 
 // src/management/oauth-management.ts
-import { z as z37 } from "zod";
+import { z as z39 } from "zod";
 var OAuthManagementClient = class {
   baseUrl;
   auth;
@@ -5811,7 +6525,7 @@ var OAuthManagementClient = class {
       path: MGMT_OAUTH_INVALIDATE_PATH,
       params: { token },
       body,
-      responseSchema: z37.string(),
+      responseSchema: z39.string(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -6875,12 +7589,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '550e8400-...', eval_outcome: 'ALLOWED', model_uri: 'hf://org/model', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "scan uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "scan uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SCANS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SCANS_PATH}/${uuid2}`,
       responseSchema: ScanBaseResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7117,12 +7831,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '660e8400-...', rule_name: 'Pickle Scan', result: 'FAILED', violation_count: 2, ... }
    * ```
    */
-  async getEvaluation(uuid) {
-    assertUuid(uuid, "evaluation uuid");
+  async getEvaluation(uuid2) {
+    assertUuid(uuid2, "evaluation uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_EVALUATIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_EVALUATIONS_PATH}/${uuid2}`,
       responseSchema: RuleEvaluationResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7142,12 +7856,12 @@ var ModelSecurityScansClient = class {
    * // { uuid: '660e8400-...', rule_name: 'Pickle Scan', description: 'Unsafe pickle opcode', ... }
    * ```
    */
-  async getViolation(uuid) {
-    assertUuid(uuid, "violation uuid");
+  async getViolation(uuid2) {
+    assertUuid(uuid2, "violation uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_VIOLATIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_VIOLATIONS_PATH}/${uuid2}`,
       responseSchema: ViolationResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7260,12 +7974,12 @@ var ModelSecurityGroupsClient = class {
    * // { uuid: '550e8400-...', name: 'hf-strict', source_type: 'HUGGING_FACE', state: 'ACTIVE', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "security group uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "security group uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       responseSchema: ModelSecurityGroupResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7289,12 +8003,12 @@ var ModelSecurityGroupsClient = class {
    * // { uuid: '550e8400-...', name: 'hf-strict-v2', state: 'ACTIVE', ... }
    * ```
    */
-  async update(uuid, body) {
-    assertUuid(uuid, "security group uuid");
+  async update(uuid2, body) {
+    assertUuid(uuid2, "security group uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       body,
       responseSchema: ModelSecurityGroupResponseSchema,
       auth: this.auth,
@@ -7314,12 +8028,12 @@ var ModelSecurityGroupsClient = class {
    * // resolves to undefined on success
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "security group uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "security group uuid");
     await request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_GROUPS_PATH}/${uuid2}`,
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7482,12 +8196,12 @@ var ModelSecurityRulesClient = class {
    * // { uuid: '550e8400-...', name: 'Pickle Scan', rule_type: 'ARTIFACT', default_state: 'BLOCKING', ... }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "security rule uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "security rule uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_SECURITY_RULES_PATH}/${uuid}`,
+      path: `${MODEL_SEC_SECURITY_RULES_PATH}/${uuid2}`,
       responseSchema: ModelSecurityRuleResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7568,12 +8282,12 @@ var ModelSecurityModelsClient = class {
    * // { uuid: '550e8400-...', name: 'org/model', latest_version_uuid: '660e8400-...', latest_version_outcome: 'PASSED' }
    * ```
    */
-  async getModel(uuid) {
-    assertUuid(uuid, "model uuid");
+  async getModel(uuid2) {
+    assertUuid(uuid2, "model uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_MODELS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_MODELS_PATH}/${uuid2}`,
       responseSchema: ModelResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7631,12 +8345,12 @@ var ModelSecurityModelsClient = class {
    * // { uuid: '660e8400-...', revision: 'main', model_uuid: '550e8400-...', last_eval_outcome: 'PASSED' }
    * ```
    */
-  async getModelVersion(uuid) {
-    assertUuid(uuid, "model version uuid");
+  async getModelVersion(uuid2) {
+    assertUuid(uuid2, "model version uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid}`,
+      path: `${MODEL_SEC_MODEL_VERSIONS_PATH}/${uuid2}`,
       responseSchema: ModelVersionResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -7749,7 +8463,7 @@ var ModelSecurityClient = class {
 };
 
 // src/red-team/scans-client.ts
-import { z as z38 } from "zod";
+import { z as z40 } from "zod";
 var RedTeamScansClient = class {
   baseUrl;
   auth;
@@ -7893,7 +8607,7 @@ var RedTeamScansClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: RED_TEAM_CATEGORIES_PATH,
-      responseSchema: z38.array(CategoryModelSchema),
+      responseSchema: z40.array(CategoryModelSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -7901,7 +8615,7 @@ var RedTeamScansClient = class {
 };
 
 // src/red-team/reports-client.ts
-import { z as z39 } from "zod";
+import { z as z41 } from "zod";
 var RedTeamReportsClient = class {
   baseUrl;
   auth;
@@ -8276,7 +8990,7 @@ var RedTeamReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/download`,
       params: { file_format: format },
-      responseSchema: z39.unknown(),
+      responseSchema: z41.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8300,7 +9014,7 @@ var RedTeamReportsClient = class {
       method: "POST",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_REPORT_PATH}/${jobId}/generate-partial-report`,
-      responseSchema: z39.unknown(),
+      responseSchema: z41.unknown(),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8308,7 +9022,7 @@ var RedTeamReportsClient = class {
 };
 
 // src/red-team/custom-attack-reports-client.ts
-import { z as z40 } from "zod";
+import { z as z42 } from "zod";
 var RedTeamCustomAttackReportsClient = class {
   baseUrl;
   auth;
@@ -8398,7 +9112,7 @@ var RedTeamCustomAttackReportsClient = class {
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/report/${jobId}/prompt-set/${promptSetId}/prompts`,
       params,
-      responseSchema: z40.array(PromptDetailResponseSchema),
+      responseSchema: z42.array(PromptDetailResponseSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8492,7 +9206,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/attack/${attackId}/list-outputs`,
-      responseSchema: z40.array(CustomAttackOutputSchema),
+      responseSchema: z42.array(CustomAttackOutputSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8517,7 +9231,7 @@ var RedTeamCustomAttackReportsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_CUSTOM_ATTACKS_REPORT_PATH}/job/${jobId}/property-stats`,
-      responseSchema: z40.array(PropertyStatisticSchema),
+      responseSchema: z42.array(PropertyStatisticSchema),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8525,7 +9239,7 @@ var RedTeamCustomAttackReportsClient = class {
 };
 
 // src/red-team/targets-client.ts
-import { z as z41 } from "zod";
+import { z as z43 } from "zod";
 var RedTeamTargetsClient = class {
   baseUrl;
   auth;
@@ -8639,12 +9353,12 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot', status: 'READY', active: true, validated: true }
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "target uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       responseSchema: TargetResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8670,14 +9384,14 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot-v2', status: 'READY', updated_at: '2026-03-08T10:00:00Z' }
    * ```
    */
-  async update(uuid, body, opts) {
-    assertUuid(uuid, "target uuid");
+  async update(uuid2, body, opts) {
+    assertUuid(uuid2, "target uuid");
     const params = {};
     if (opts?.validate !== void 0) params.validate = String(opts.validate);
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       body,
       params: Object.keys(params).length > 0 ? params : void 0,
       responseSchema: TargetResponseSchema,
@@ -8699,12 +9413,12 @@ var RedTeamTargetsClient = class {
    * // { message: 'ok', status: 200 }
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "target uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}`,
       responseSchema: BaseResponseSchema.optional(),
       allowEmptyBody: true,
       auth: this.auth,
@@ -8754,12 +9468,12 @@ var RedTeamTargetsClient = class {
    * // { target_id: '550e8400-...', target_version: 1, status: 'READY' }
    * ```
    */
-  async getProfile(uuid) {
-    assertUuid(uuid, "target uuid");
+  async getProfile(uuid2) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}/profile`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}/profile`,
       responseSchema: TargetProfileResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8783,12 +9497,12 @@ var RedTeamTargetsClient = class {
    * // { uuid: '550e8400-...', name: 'prod-chatbot', status: 'READY' }
    * ```
    */
-  async updateProfile(uuid, body) {
-    assertUuid(uuid, "target uuid");
+  async updateProfile(uuid2, body) {
+    assertUuid(uuid2, "target uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_TARGET_PATH}/${uuid}/profile`,
+      path: `${RED_TEAM_TARGET_PATH}/${uuid2}/profile`,
       body,
       responseSchema: TargetResponseSchema,
       auth: this.auth,
@@ -8841,7 +9555,7 @@ var RedTeamTargetsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: `${RED_TEAM_TEMPLATE_PATH}/target-metadata`,
-      responseSchema: z41.record(z41.unknown()),
+      responseSchema: z43.record(z43.unknown()),
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -8962,12 +9676,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', active: true, archive: false }
    * ```
    */
-  async getPromptSet(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSet(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}`,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -8990,12 +9704,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks-v2', status: 'READY', active: true }
    * ```
    */
-  async updatePromptSet(uuid, body) {
-    assertUuid(uuid, "prompt set uuid");
+  async updatePromptSet(uuid2, body) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}`,
       body,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
@@ -9019,12 +9733,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', archive: true }
    * ```
    */
-  async archivePromptSet(uuid, body) {
-    assertUuid(uuid, "prompt set uuid");
+  async archivePromptSet(uuid2, body) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/archive`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/archive`,
       body,
       responseSchema: CustomPromptSetResponseSchema,
       auth: this.auth,
@@ -9045,12 +9759,12 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', name: 'jailbreaks', status: 'READY', active: true, tsg_id: 'tsg-1' }
    * ```
    */
-  async getPromptSetReference(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSetReference(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/reference`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/reference`,
       responseSchema: CustomPromptSetReferenceSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -9071,14 +9785,14 @@ var RedTeamCustomAttacksClient = class {
    * // { uuid: '550e8400-...', status: 'READY', is_latest: true, version: 'gen-12345' }
    * ```
    */
-  async getPromptSetVersionInfo(uuid, opts) {
-    assertUuid(uuid, "prompt set uuid");
+  async getPromptSetVersionInfo(uuid2, opts) {
+    assertUuid(uuid2, "prompt set uuid");
     const params = {};
     if (opts?.version !== void 0) params.version = opts.version;
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid}/version-info`,
+      path: `${RED_TEAM_CUSTOM_ATTACK_PATH}/custom-prompt-set/${uuid2}/version-info`,
       params: Object.keys(params).length > 0 ? params : void 0,
       responseSchema: CustomPromptSetVersionInfoSchema,
       auth: this.auth,
@@ -9126,10 +9840,10 @@ var RedTeamCustomAttacksClient = class {
    * // 'prompt,goal,category,severity\n'
    * ```
    */
-  async downloadTemplate(uuid) {
-    assertUuid(uuid, "prompt set uuid");
+  async downloadTemplate(uuid2) {
+    assertUuid(uuid2, "prompt set uuid");
     const url = new URL(
-      `${this.baseUrl.replace(/\/+$/, "")}${RED_TEAM_CUSTOM_ATTACK_PATH}/download-template/${uuid}`
+      `${this.baseUrl.replace(/\/+$/, "")}${RED_TEAM_CUSTOM_ATTACK_PATH}/download-template/${uuid2}`
     );
     const stub = {
       method: "GET",
@@ -10030,12 +10744,12 @@ var RedTeamAdaptersClient = class {
    * // adapter.status => 'ACTIVE'
    * ```
    */
-  async get(uuid) {
-    assertUuid(uuid, "adapter uuid");
+  async get(uuid2) {
+    assertUuid(uuid2, "adapter uuid");
     return request({
       method: "GET",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       responseSchema: AdapterResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -10063,13 +10777,13 @@ var RedTeamAdaptersClient = class {
    * });
    * ```
    */
-  async update(uuid, body, opts) {
-    assertUuid(uuid, "adapter uuid");
+  async update(uuid2, body, opts) {
+    assertUuid(uuid2, "adapter uuid");
     const validate = opts?.validate ?? true;
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       params: { validate: String(validate) },
       body,
       responseSchema: AdapterResponseSchema,
@@ -10085,12 +10799,12 @@ var RedTeamAdaptersClient = class {
    * await rt.adapters.delete('550e8400-e29b-41d4-a716-446655440000');
    * ```
    */
-  async delete(uuid) {
-    assertUuid(uuid, "adapter uuid");
+  async delete(uuid2) {
+    assertUuid(uuid2, "adapter uuid");
     return request({
       method: "DELETE",
       baseUrl: this.baseUrl,
-      path: `${RED_TEAM_ADAPTER_PATH}/${uuid}`,
+      path: `${RED_TEAM_ADAPTER_PATH}/${uuid2}`,
       responseSchema: BaseResponseSchema.optional(),
       allowEmptyBody: true,
       auth: this.auth,
@@ -10959,12 +11673,12 @@ var AIGatewayWorkspacesClient = class {
    * const other = await gw.workspaces.get('ws-produc-985697', { plane: 'admin' });
    * ```
    */
-  async get(workspaceRef, options = {}) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
+  async get(workspaceRef2, options = {}) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "GET",
       baseUrl: this.urlFor(options.plane),
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       responseSchema: GatewayWorkspaceDetailSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -10993,17 +11707,12 @@ var AIGatewayWorkspacesClient = class {
    * ```
    */
   async create(body) {
-    if (!body.name) {
-      throw new AISecSDKException("Missing name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
-    }
-    if (!body.scope_name) {
-      throw new AISecSDKException("Missing scope_name", "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
-    }
     return request({
       method: "POST",
       baseUrl: this.adminBaseUrl,
       path: AI_GW_WORKSPACES_PATH,
       body,
+      requestSchema: GatewayWorkspaceCreateRequestSchema,
       responseSchema: GatewayWorkspaceCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11028,19 +11737,14 @@ var AIGatewayWorkspacesClient = class {
    * });
    * ```
    */
-  async update(workspaceRef, body) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
-    if (Object.keys(body).length === 0) {
-      throw new AISecSDKException(
-        "Empty update: provide at least one of name, description, icon, defaults, usage_limits, rate_limits",
-        "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */
-      );
-    }
+  async update(workspaceRef2, body) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "PUT",
       baseUrl: this.adminBaseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       body,
+      requestSchema: GatewayWorkspaceUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11071,12 +11775,12 @@ var AIGatewayWorkspacesClient = class {
    * const gone = await gw.workspaces.list({ plane: 'admin', status: 'archived' });
    * ```
    */
-  async delete(workspaceRef) {
-    assertWorkspaceRef(workspaceRef, "workspaceRef");
+  async delete(workspaceRef2) {
+    assertWorkspaceRef(workspaceRef2, "workspaceRef");
     return request({
       method: "DELETE",
       baseUrl: this.adminBaseUrl,
-      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef}`,
+      path: `${AI_GW_WORKSPACES_PATH}/${workspaceRef2}`,
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -11149,6 +11853,29 @@ var AIGatewayConfigsClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * List the immutable version history for one config. Verified live 2026-08-29.
+   * @param configId - Config UUID.
+   * @returns Config versions, including version ownership and creation timestamps.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const versions = await gw.configs.listVersions('764cf9cd-4ebf-449e-b669-08149b0fbbbc');
+   * console.log(versions.data[0].version_id);
+   * ```
+   */
+  async listVersions(configId) {
+    assertUuid(configId, "configId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_CONFIGS_PATH}/${configId}/versions`,
+      responseSchema: ListConfigVersionsResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Create a config.
    *
@@ -11179,6 +11906,7 @@ var AIGatewayConfigsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_CONFIGS_PATH,
       body,
+      requestSchema: GatewayConfigCreateRequestSchema,
       responseSchema: GatewayConfigCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11187,7 +11915,7 @@ var AIGatewayConfigsClient = class {
   /**
    * Update a config.
    * @param configId - Config UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update. A supplied `config` replaces the routing document.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -11203,12 +11931,12 @@ var AIGatewayConfigsClient = class {
    */
   async update(configId, body) {
     assertUuid(configId, "configId");
-    assertUuid(body.workspace_id, "workspace_id");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
       path: `${AI_GW_CONFIGS_PATH}/${configId}`,
       body,
+      requestSchema: GatewayConfigUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11336,11 +12064,39 @@ var AIGatewayGuardrailsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_GUARDRAILS_PATH,
       body,
+      requestSchema: GatewayGuardrailCreateRequestSchema,
       responseSchema: GatewayGuardrailCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Update a guardrail. Verified live 2026-08-29.
+   * @param guardrailId - Guardrail UUID.
+   * @param body - Fields to update.
+   * @returns The gateway write response.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * await gw.guardrails.update('9f6c2a8e-2b3d-4e5f-8a9b-0c1d2e3f4a5b', {
+   *   name: 'Updated guardrail',
+   * });
+   * ```
+   */
+  async update(guardrailId, body) {
+    assertUuid(guardrailId, "guardrailId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_GUARDRAILS_PATH}/${guardrailId}`,
+      body,
+      requestSchema: GatewayGuardrailUpdateRequestSchema,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Delete a guardrail.
    *
@@ -11407,6 +12163,34 @@ var AIGatewayProvidersClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * Fetch one provider binding. Verified live 2026-08-29.
+   *
+   * @remarks The response can contain provider credential material. Do not log or persist it,
+   * and avoid logging the complete returned object. SDK debug logs redact the known credential
+   * fields for this operation.
+   * @param providerId - Provider UUID.
+   * @returns Provider configuration and lifecycle detail.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const provider = await gw.providers.get('f6692544-3265-49be-9711-bbdcebc079e4');
+   * console.log(provider.name);
+   * ```
+   */
+  async get(providerId) {
+    assertUuid(providerId, "providerId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_PROVIDERS_PATH}/${providerId}`,
+      secretOperation: "providers.get",
+      responseSchema: GatewayProviderDetailSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Create a provider.
    *
@@ -11442,11 +12226,40 @@ var AIGatewayProvidersClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_PROVIDERS_PATH,
       body,
+      requestSchema: GatewayProviderCreateRequestSchema,
       responseSchema: GatewayProviderCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Update a provider binding. Verified live 2026-08-29.
+   * @param providerId - Provider UUID.
+   * @param body - Fields to update.
+   * @returns The gateway write response.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * await gw.providers.update('f6692544-3265-49be-9711-bbdcebc079e4', {
+   *   name: 'Vertex production',
+   *   note: 'Updated by automation',
+   * });
+   * ```
+   */
+  async update(providerId, body) {
+    assertUuid(providerId, "providerId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_PROVIDERS_PATH}/${providerId}`,
+      body,
+      requestSchema: GatewayProviderUpdateRequestSchema,
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Delete a provider.
    *
@@ -11502,13 +12315,14 @@ var AIGatewayApiKeysClient = class {
     });
   }
   /** @internal */
-  writeAt(method, path, body) {
-    assertUuid(body.workspace_id, "workspace_id");
+  writeAt(method, path, body, requestSchema, secretOperation) {
     return request({
       method,
       baseUrl: this.baseUrl,
       path,
       body,
+      requestSchema,
+      secretOperation,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11546,6 +12360,65 @@ var AIGatewayApiKeysClient = class {
   async listUser(opts) {
     return this.listAt(AI_GW_API_KEYS_USER_PATH, opts);
   }
+  getAt(path, keyId) {
+    assertUuid(keyId, "keyId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${path}/${keyId}`,
+      responseSchema: GatewayApiKeySchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  async deleteAt(path, keyId) {
+    assertUuid(keyId, "keyId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${path}/${keyId}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  rotateAt(path, keyId, body, secretOperation) {
+    assertUuid(keyId, "keyId");
+    return request({
+      method: "POST",
+      baseUrl: this.baseUrl,
+      path: `${path}/${keyId}/rotate`,
+      body,
+      requestSchema: GatewayApiKeyRotateRequestSchema,
+      secretOperation,
+      responseSchema: GatewayApiKeyRotateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /** Get a service key. @example `await gw.apiKeys.getService(keyId);` */
+  async getService(keyId) {
+    return this.getAt(AI_GW_API_KEYS_SERVICE_PATH, keyId);
+  }
+  /** Get a user key. @example `await gw.apiKeys.getUser(keyId);` */
+  async getUser(keyId) {
+    return this.getAt(AI_GW_API_KEYS_USER_PATH, keyId);
+  }
+  /** Permanently delete a service key. @example `await gw.apiKeys.deleteService(keyId);` */
+  async deleteService(keyId) {
+    return this.deleteAt(AI_GW_API_KEYS_SERVICE_PATH, keyId);
+  }
+  /** Permanently delete a user key. @example `await gw.apiKeys.deleteUser(keyId);` */
+  async deleteUser(keyId) {
+    return this.deleteAt(AI_GW_API_KEYS_USER_PATH, keyId);
+  }
+  /** Rotate a service key; capture the returned secret. @example `const rotated = await gw.apiKeys.rotateService(keyId);` */
+  async rotateService(keyId, body = {}) {
+    return this.rotateAt(AI_GW_API_KEYS_SERVICE_PATH, keyId, body, "apiKeys.rotateService");
+  }
+  /** Rotate a user key; capture the returned secret. @example `const rotated = await gw.apiKeys.rotateUser(keyId);` */
+  async rotateUser(keyId, body = {}) {
+    return this.rotateAt(AI_GW_API_KEYS_USER_PATH, keyId, body, "apiKeys.rotateUser");
+  }
   /**
    * Create a service API key.
    * @param body - Name, scopes, TSG, workspace UUID, and type.
@@ -11565,7 +12438,13 @@ var AIGatewayApiKeysClient = class {
    * ```
    */
   async createService(body) {
-    return this.writeAt("POST", AI_GW_API_KEYS_SERVICE_PATH, body);
+    return this.writeAt(
+      "POST",
+      AI_GW_API_KEYS_SERVICE_PATH,
+      body,
+      GatewayServiceApiKeyCreateRequestSchema,
+      "apiKeys.createService"
+    );
   }
   /**
    * Create a user API key.
@@ -11587,12 +12466,18 @@ var AIGatewayApiKeysClient = class {
    * ```
    */
   async createUser(body) {
-    return this.writeAt("POST", AI_GW_API_KEYS_USER_PATH, body);
+    return this.writeAt(
+      "POST",
+      AI_GW_API_KEYS_USER_PATH,
+      body,
+      GatewayUserApiKeyCreateRequestSchema,
+      "apiKeys.createUser"
+    );
   }
   /**
    * Update a service API key.
    * @param keyId - Key UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -11610,12 +12495,17 @@ var AIGatewayApiKeysClient = class {
    */
   async updateService(keyId, body) {
     assertUuid(keyId, "keyId");
-    return this.writeAt("PUT", `${AI_GW_API_KEYS_SERVICE_PATH}/${keyId}`, body);
+    return this.writeAt(
+      "PUT",
+      `${AI_GW_API_KEYS_SERVICE_PATH}/${keyId}`,
+      body,
+      GatewayApiKeyUpdateRequestSchema
+    );
   }
   /**
    * Update a user API key.
    * @param keyId - Key UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -11634,7 +12524,12 @@ var AIGatewayApiKeysClient = class {
    */
   async updateUser(keyId, body) {
     assertUuid(keyId, "keyId");
-    return this.writeAt("PUT", `${AI_GW_API_KEYS_USER_PATH}/${keyId}`, body);
+    return this.writeAt(
+      "PUT",
+      `${AI_GW_API_KEYS_USER_PATH}/${keyId}`,
+      body,
+      GatewayApiKeyUpdateRequestSchema
+    );
   }
 };
 
@@ -11698,8 +12593,8 @@ var AIGatewayIntegrationsClient = class {
    * Create an integration.
    *
    * @remarks
-   * `body.key` (the provider API key) is a live secret. Setting `PANW_AI_SEC_DEBUG` will
-   * print it, unredacted, to the SDK's own debug log.
+   * `body.key` (the provider API key) is a live secret. SDK debug logs replace known
+   * credential fields with `[REDACTED]`, but callers must still avoid logging the input object.
    *
    * @param body - Provider id, name, slug, and provider-specific configuration.
    * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
@@ -11724,6 +12619,8 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_INTEGRATIONS_PATH,
       body,
+      requestSchema: GatewayIntegrationCreateRequestSchema,
+      secretOperation: "integrations.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11732,7 +12629,7 @@ var AIGatewayIntegrationsClient = class {
   /**
    * Update an integration.
    * @param integrationId - Integration UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -11747,12 +12644,13 @@ var AIGatewayIntegrationsClient = class {
    */
   async update(integrationId, body) {
     assertUuid(integrationId, "integrationId");
-    if (body.ai_provider_id !== void 0) assertUuid(body.ai_provider_id, "ai_provider_id");
     return request({
       method: "PUT",
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}`,
       body,
+      requestSchema: GatewayIntegrationUpdateRequestSchema,
+      secretOperation: "integrations.update",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11808,9 +12706,9 @@ var AIGatewayIntegrationsClient = class {
     });
   }
   /**
-   * Replace which models this integration exposes.
+   * Bulk-update model enablement for this integration.
    * @param integrationId - Integration UUID.
-   * @param body - Full model list; this is a replace, not a merge.
+   * @param body - One or more model entries to update; omission is not documented as deletion.
    * @returns The raw response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -11829,6 +12727,7 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/models`,
       body,
+      requestSchema: GatewayIntegrationModelsBulkUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11840,7 +12739,7 @@ var AIGatewayIntegrationsClient = class {
    * @remarks
    * `global_workspace_access` is an **object** on this read, not a boolean, despite the
    * field name — `{ enabled, rate_limits, usage_limits }`. The corresponding write
-   * ({@link setWorkspaces}) DOES send a plain boolean; the two are not symmetric.
+   * ({@link setWorkspaces}) uses the same object shape.
    *
    * @param integrationId - Integration UUID.
    * @returns Bound workspaces plus the `global_workspace_access` object.
@@ -11865,9 +12764,9 @@ var AIGatewayIntegrationsClient = class {
     });
   }
   /**
-   * Replace which workspaces may use this integration.
+   * Bulk-update which workspaces may use this integration.
    * @param integrationId - Integration UUID.
-   * @param body - Workspace bindings or a global-access flag.
+   * @param body - Workspace bindings, global-access settings, or explicit override behavior.
    * @returns The raw response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -11875,7 +12774,7 @@ var AIGatewayIntegrationsClient = class {
    * const gw = new AIGatewayClient();
    *
    * await gw.integrations.setWorkspaces('f6692544-3265-49be-9711-bbdcebc079e4', {
-   *   global_workspace_access: true,
+   *   global_workspace_access: { enabled: true },
    * });
    * ```
    */
@@ -11886,6 +12785,7 @@ var AIGatewayIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_INTEGRATIONS_PATH}/${integrationId}/workspaces`,
       body,
+      requestSchema: GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -11925,6 +12825,75 @@ var AIGatewayMcpIntegrationsClient = class {
       numRetries: this.numRetries
     });
   }
+  /**
+   * Fetch one MCP integration. Verified live 2026-08-29.
+   * @param mcpIntegrationId - MCP integration UUID.
+   * @returns Integration detail; unlike list rows, `configurations` is an object.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const integration = await gw.mcpIntegrations.get('2a6f4e2e-6f5a-4a1f-9d0e-9b2b6f6c3a11');
+   * console.log(integration.url);
+   * ```
+   */
+  async get(mcpIntegrationId) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}`,
+      responseSchema: McpIntegrationDetailSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * List capabilities discovered from an MCP integration. Verified live 2026-08-29.
+   * @param mcpIntegrationId - MCP integration UUID.
+   * @returns Tools, prompts, resources, and resource templates with enablement counts.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const capabilities = await gw.mcpIntegrations.getCapabilities('2a6f4e2e-6f5a-4a1f-9d0e-9b2b6f6c3a11');
+   * console.log(capabilities.data.map((capability) => capability.name));
+   * ```
+   */
+  async getCapabilities(mcpIntegrationId) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/capabilities`,
+      responseSchema: McpIntegrationCapabilitiesResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Fetch metadata discovered from an MCP server. Verified live 2026-08-29.
+   * @param mcpIntegrationId - MCP integration UUID.
+   * @returns Server identity, protocol, capability flags, and sync state.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const metadata = await gw.mcpIntegrations.getMetadata('2a6f4e2e-6f5a-4a1f-9d0e-9b2b6f6c3a11');
+   * console.log(metadata.sync_status);
+   * ```
+   */
+  async getMetadata(mcpIntegrationId) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/metadata`,
+      responseSchema: McpIntegrationMetadataSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Register an MCP server.
    * @param body - Name, server URL, auth type, transport, and provider-specific configuration.
@@ -11950,23 +12919,68 @@ var AIGatewayMcpIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_MCP_INTEGRATIONS_PATH,
       body,
+      requestSchema: McpIntegrationCreateRequestSchema,
+      secretOperation: "mcpIntegrations.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /** Update an MCP integration. @example `await gw.mcpIntegrations.update(id, { name: 'Docs MCP' });` */
+  async update(mcpIntegrationId, body) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}`,
+      body,
+      requestSchema: McpIntegrationUpdateRequestSchema,
+      secretOperation: "mcpIntegrations.update",
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /** Permanently delete an MCP integration. @example `await gw.mcpIntegrations.delete(id);` */
+  async delete(mcpIntegrationId) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    await request({
+      method: "DELETE",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}`,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /** Bulk-update capability enablement values. @example `await gw.mcpIntegrations.setCapabilities(id, { capabilities: [{ name: 'lookup', type: 'tool', enabled: true }] });` */
+  async setCapabilities(mcpIntegrationId, body) {
+    assertUuid(mcpIntegrationId, "mcpIntegrationId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/capabilities`,
+      body,
+      requestSchema: McpIntegrationCapabilitiesBulkUpdateRequestSchema,
+      responseSchema: McpIntegrationCapabilitiesUpdateResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
-   * Replace which workspaces may use this MCP integration.
+   * Bulk-update which workspaces may use this MCP integration.
    * @param mcpIntegrationId - MCP integration UUID.
-   * @param body - Workspace bindings or a global-access flag; this is a replace, not a merge.
-   * @returns The raw response. Shape unverified against a live tenant — see the PRD.
+   * @param body - Workspace bindings or global-access settings. Use the explicit override flag
+   * to request replacement behavior.
+   * @returns An empty object. Verified live 2026-08-30.
    * @example
    * ```ts
    * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
    * const gw = new AIGatewayClient();
    *
    * await gw.mcpIntegrations.setWorkspaces('f6692544-3265-49be-9711-bbdcebc079e4', {
-   *   global_workspace_access: true,
+   *   workspaces: [{ id: 'ws-development', enabled: true }],
+   *   global_workspace_access: { enabled: false },
+   *   override_existing_workspace_access: true,
    * });
    * ```
    */
@@ -11977,7 +12991,8 @@ var AIGatewayMcpIntegrationsClient = class {
       baseUrl: this.baseUrl,
       path: `${AI_GW_MCP_INTEGRATIONS_PATH}/${mcpIntegrationId}/workspaces`,
       body,
-      responseSchema: GatewayWriteResponseSchema,
+      requestSchema: McpIntegrationWorkspacesBulkUpdateRequestSchema,
+      responseSchema: McpIntegrationWorkspacesUpdateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
@@ -12055,8 +13070,8 @@ var AIGatewayDeploymentsClient = class {
    *
    * This is the **only** time `credentials.password` and `client_auth` are readable; the
    * detail read masks them. Capture them here or they are unrecoverable. Never log them.
-   * Note that setting `PANW_AI_SEC_DEBUG` will print the raw request/response, including
-   * `credentials.password`, to the SDK's own debug log regardless of this warning.
+   * SDK debug logs redact returned one-time `client_auth` and registry passwords. Callers
+   * must still capture the create response once and store it securely.
    *
    * @param body - Name, type, TSG, and auth settings.
    * @returns The creation receipt including the deployment's gateway credentials.
@@ -12081,11 +13096,67 @@ var AIGatewayDeploymentsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_DEPLOYMENTS_PATH,
       body,
+      requestSchema: GatewayDeploymentCreateRequestSchema,
+      secretOperation: "deployments.create",
       responseSchema: GatewayDeploymentCreateResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
     });
   }
+  /**
+   * Update deployment settings, including its externally deployed gateway URL and workspace scope.
+   * @param deploymentId - Deployment UUID.
+   * @param body - Fields to update.
+   * @returns The gateway write response.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * await gw.deployments.update('21414819-485e-4ba3-b3d3-3e1815580e43', {
+   *   auth_settings: {
+   *     gateway_base_url: 'https://gateway.example.com',
+   *     workspaces_allowed: ['ws-develo-71f8d8'],
+   *   },
+   * });
+   * ```
+   */
+  async update(deploymentId, body) {
+    assertUuid(deploymentId, "deploymentId");
+    return request({
+      method: "PUT",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_DEPLOYMENTS_PATH}/${deploymentId}`,
+      body,
+      requestSchema: GatewayDeploymentUpdateRequestSchema,
+      secretOperation: "deployments.update",
+      responseSchema: GatewayWriteResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
+  /**
+   * Run SCM's outbound and inbound connectivity checks against a configured gateway.
+   * @param deploymentId - Deployment UUID.
+   * @returns Health of both connectivity directions.
+   * @example
+   * ```ts
+   * import { AIGatewayClient } from '@cdot65/prisma-airs-sdk';
+   * const gw = new AIGatewayClient();
+   * const health = await gw.deployments.ping('21414819-485e-4ba3-b3d3-3e1815580e43');
+   * console.log(health.status, health.outbound.status, health.inbound.status);
+   * ```
+   */
+  async ping(deploymentId) {
+    assertUuid(deploymentId, "deploymentId");
+    return request({
+      method: "GET",
+      baseUrl: this.baseUrl,
+      path: `${AI_GW_DEPLOYMENTS_PATH}/${deploymentId}/ping`,
+      responseSchema: GatewayDeploymentPingResponseSchema,
+      auth: this.auth,
+      numRetries: this.numRetries
+    });
+  }
   /**
    * Archive a deployment.
    *
@@ -12160,8 +13231,8 @@ var AIGatewayPluginsClient = class {
    * Bind a plugin to the organisation.
    *
    * @remarks
-   * `body.credentials` (e.g. `AIRS_API_KEY`) is a live secret. Setting `PANW_AI_SEC_DEBUG`
-   * will print it, unredacted, to the SDK's own debug log.
+   * `body.credentials` (e.g. `AIRS_API_KEY`) is a live secret. SDK debug logs replace each
+   * credential value with `[REDACTED]`, but callers must still avoid logging the input object.
    *
    * @param body - Integration id and provider-specific credentials.
    * @returns The raw create response. Shape unverified against a live tenant — see the PRD.
@@ -12184,6 +13255,8 @@ var AIGatewayPluginsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_PLUGINS_PATH,
       body,
+      requestSchema: GatewayPluginCreateRequestSchema,
+      secretOperation: "plugins.create",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12225,7 +13298,7 @@ var AIGatewayOrganisationsClient = class {
   }
   /**
    * Update the calling organisation's settings.
-   * @param body - Replacement fields.
+   * @param body - One or more fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12241,6 +13314,7 @@ var AIGatewayOrganisationsClient = class {
       baseUrl: this.baseUrl,
       path: AI_GW_ORGANISATIONS_SELF_PATH,
       body,
+      requestSchema: GatewayOrganisationUpdateRequestSchema,
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12251,8 +13325,8 @@ var AIGatewayOrganisationsClient = class {
    *
    * @remarks
    * The response includes a `scim_token` — a live secret. Never log the returned object.
-   * Note that setting `PANW_AI_SEC_DEBUG` will print it (unredacted) to the SDK's own debug
-   * log regardless of this warning, since debug logging only sanitizes header values.
+   * SDK debug logs redact `scim_token` and known nested client-secret fields. Callers must
+   * still avoid logging the input object or returned auth settings directly.
    *
    * @param tsgId - The TSG as a numeric string, not a UUID.
    * @returns Auth settings, including domains and the SCIM token.
@@ -12271,6 +13345,7 @@ var AIGatewayOrganisationsClient = class {
       method: "GET",
       baseUrl: this.baseUrl,
       path: aiGwOrganisationsAuthSettingsPath(tsgId),
+      secretOperation: "organisations.getAuthSettings",
       responseSchema: AuthSettingsResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12279,7 +13354,7 @@ var AIGatewayOrganisationsClient = class {
   /**
    * Update an organisation's auth settings.
    * @param tsgId - The TSG as a numeric string, not a UUID.
-   * @param body - Replacement fields.
+   * @param body - One or more auth-setting fields to update.
    * @returns The raw update response. Shape unverified against a live tenant — see the PRD.
    * @example
    * ```ts
@@ -12298,6 +13373,8 @@ var AIGatewayOrganisationsClient = class {
       baseUrl: this.baseUrl,
       path: aiGwOrganisationsAuthSettingsPath(tsgId),
       body,
+      requestSchema: GatewayOrganisationAuthSettingsUpdateRequestSchema,
+      secretOperation: "organisations.updateAuthSettings",
       responseSchema: GatewayWriteResponseSchema,
       auth: this.auth,
       numRetries: this.numRetries
@@ -12415,6 +13492,165 @@ var AIGatewayClient = class {
     this.auditLogs = new AIGatewayAuditLogsClient(adminOpts);
   }
 };
+
+// src/ai-gateway/nested-values.ts
+var FORBIDDEN_SEGMENTS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var ESCAPABLE = /* @__PURE__ */ new Set([".", "[", "]", "\\"]);
+function invalid(message) {
+  throw new AISecSDKException(message, "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+}
+function pushProperty(tokens, value2, path) {
+  if (!value2) invalid(`Invalid dotted path: ${path}`);
+  if (FORBIDDEN_SEGMENTS.has(value2)) invalid(`Unsafe dotted path segment: ${value2}`);
+  tokens.push(value2);
+}
+function parsePath(path) {
+  if (!path) invalid("Dotted path must not be empty");
+  const tokens = [];
+  let property = "";
+  let afterDot = false;
+  let afterIndex = false;
+  for (let i = 0; i < path.length; i++) {
+    const char = path[i];
+    if (char === "\\") {
+      const escaped = path[++i];
+      if (escaped === void 0 || !ESCAPABLE.has(escaped)) {
+        invalid(`Invalid escape in dotted path: ${path}`);
+      }
+      if (afterIndex) invalid(`Missing dot after array index in path: ${path}`);
+      property += escaped;
+      afterDot = false;
+      continue;
+    }
+    if (char === ".") {
+      if (property) {
+        pushProperty(tokens, property, path);
+        property = "";
+      } else if (!afterIndex) {
+        invalid(`Invalid empty segment in dotted path: ${path}`);
+      }
+      afterDot = true;
+      afterIndex = false;
+      continue;
+    }
+    if (char === "[") {
+      if (afterDot) invalid(`Invalid array segment in dotted path: ${path}`);
+      if (property) {
+        pushProperty(tokens, property, path);
+        property = "";
+      } else if (tokens.length === 0) {
+        invalid(`Dotted paths must start with an object property: ${path}`);
+      }
+      const close = path.indexOf("]", i + 1);
+      if (close === -1) invalid(`Unclosed array index in dotted path: ${path}`);
+      const rawIndex = path.slice(i + 1, close);
+      if (!/^(0|[1-9]\d*)$/.test(rawIndex)) invalid(`Invalid array index in dotted path: ${path}`);
+      tokens.push(Number(rawIndex));
+      i = close;
+      afterIndex = true;
+      afterDot = false;
+      continue;
+    }
+    if (char === "]") invalid(`Unexpected ] in dotted path: ${path}`);
+    if (afterIndex) invalid(`Missing dot after array index in path: ${path}`);
+    property += char;
+    afterDot = false;
+  }
+  if (property) pushProperty(tokens, property, path);
+  else if (afterDot) invalid(`Dotted path must not end with a dot: ${path}`);
+  if (tokens.length === 0) invalid(`Invalid dotted path: ${path}`);
+  return tokens;
+}
+function isContainerFor(value2, expectArray) {
+  return expectArray ? Array.isArray(value2) : typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function readSegment(container, segment) {
+  return typeof segment === "number" ? container[segment] : container[segment];
+}
+function writeSegment(container, segment, value2) {
+  if (typeof segment === "number") container[segment] = value2;
+  else container[segment] = value2;
+}
+function assign(root, tokens, value2, replaceExisting) {
+  let current = root;
+  for (let i = 0; i < tokens.length; i++) {
+    const segment = tokens[i];
+    const final = i === tokens.length - 1;
+    if (typeof segment === "number" && !Array.isArray(current)) {
+      invalid("Array index conflicts with an object path");
+    }
+    if (typeof segment === "string" && Array.isArray(current)) {
+      invalid("Object property conflicts with an array path");
+    }
+    const hasValue = Object.prototype.hasOwnProperty.call(current, segment);
+    if (final) {
+      if (hasValue && !replaceExisting) invalid("Duplicate dotted path");
+      writeSegment(current, segment, value2);
+      return;
+    }
+    const expectArray = typeof tokens[i + 1] === "number";
+    if (!hasValue) {
+      writeSegment(current, segment, expectArray ? [] : {});
+    } else {
+      const existing = readSegment(current, segment);
+      if (!isContainerFor(existing, expectArray)) invalid("Dotted path shape conflict");
+    }
+    current = readSegment(current, segment);
+  }
+}
+function assertDenseArrays(value2) {
+  if (Array.isArray(value2)) {
+    for (let i = 0; i < value2.length; i++) {
+      if (!Object.prototype.hasOwnProperty.call(value2, i))
+        invalid("Sparse arrays are not supported");
+      assertDenseArrays(value2[i]);
+    }
+    return;
+  }
+  if (typeof value2 === "object" && value2 !== null) {
+    for (const nested of Object.values(value2)) assertDenseArrays(nested);
+  }
+}
+function cloneJson(value2) {
+  if (Array.isArray(value2)) {
+    return value2.map((item) => cloneJson(item));
+  }
+  if (typeof value2 === "object" && value2 !== null) {
+    return Object.fromEntries(
+      Object.entries(value2).map(([key, item]) => [key, cloneJson(item)])
+    );
+  }
+  return value2;
+}
+function parseJsonValue(value2) {
+  const result = GatewayJsonValueSchema.safeParse(value2);
+  if (!result.success) invalid("Dotted value must be finite JSON");
+  return cloneJson(result.data);
+}
+function buildDottedObject(entries) {
+  const parsed = entries.map((entry) => ({
+    tokens: parsePath(entry.path),
+    value: parseJsonValue(entry.value)
+  }));
+  const identities = /* @__PURE__ */ new Set();
+  for (const entry of parsed) {
+    const identity = JSON.stringify(entry.tokens);
+    if (identities.has(identity)) invalid("Duplicate dotted path");
+    identities.add(identity);
+  }
+  const result = {};
+  for (const entry of parsed) assign(result, entry.tokens, entry.value, false);
+  assertDenseArrays(result);
+  return result;
+}
+function setDottedValue(input, path, value2) {
+  const parsedInput = GatewayJsonObjectSchema.safeParse(input);
+  if (!parsedInput.success) invalid("Input must be a finite JSON object");
+  const result = cloneJson(parsedInput.data);
+  assign(result, parsePath(path), parseJsonValue(value2), true);
+  assertDenseArrays(result);
+  return result;
+}
 export {
   AIGatewayApiKeysClient,
   AIGatewayAuditLogsClient,
@@ -12431,6 +13667,18 @@ export {
   AIGatewayWorkspacesClient,
   AIRS_ENDPOINTS,
   AISecSDKException,
+  AI_GATEWAY_DEPLOYMENT_STATUSES,
+  AI_GATEWAY_DEPLOYMENT_TYPES,
+  AI_GATEWAY_KNOWN_API_KEY_SCOPES,
+  AI_GATEWAY_KNOWN_CACHE_MODES,
+  AI_GATEWAY_KNOWN_CONFIG_STRATEGIES,
+  AI_GATEWAY_KNOWN_MCP_AUTH_TYPES,
+  AI_GATEWAY_KNOWN_MCP_TRANSPORTS,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_TYPES,
+  AI_GATEWAY_KNOWN_RATE_LIMIT_UNITS,
+  AI_GATEWAY_MUTABLE_MCP_CAPABILITY_TYPES,
+  AI_GATEWAY_REDACTED,
+  AI_GATEWAY_SECRET_FIELDS,
   AI_GW_ADMIN_ENDPOINT,
   AI_GW_API_KEYS_SERVICE_PATH,
   AI_GW_API_KEYS_USER_PATH,
@@ -12682,35 +13930,100 @@ export {
   FileScanDataSchema,
   FileScanResult,
   FileType,
+  GatewayApiKeyCreateRequestSchema,
+  GatewayApiKeyRotateRequestSchema,
+  GatewayApiKeyRotateResponseSchema,
+  GatewayApiKeyRotationPolicySchema,
   GatewayApiKeySchema,
+  GatewayApiKeyScopeSchema,
+  GatewayApiKeyUpdateRequestSchema,
   GatewayAuditLogRecordSchema,
   GatewayAuditLogsResponseSchema,
+  GatewayAzureAIConfigurationSchema,
+  GatewayAzureDeploymentConfigurationSchema,
+  GatewayAzureOpenAIConfigurationSchema,
+  GatewayBedrockConfigurationSchema,
   GatewayChartRecordSchema,
+  GatewayConfigCacheModeSchema,
+  GatewayConfigCreateRequestSchema,
   GatewayConfigCreateResponseSchema,
   GatewayConfigDetailSchema,
   GatewayConfigSchema,
+  GatewayConfigStrategySchema,
+  GatewayConfigUpdateRequestSchema,
+  GatewayConfigVersionSchema,
+  GatewayCortexConfigurationSchema,
+  GatewayCustomHostConfigurationSchema,
+  GatewayDefaultsInputSchema,
+  GatewayDeploymentAuthSettingsInputSchema,
+  GatewayDeploymentCreateRequestSchema,
   GatewayDeploymentCreateResponseSchema,
   GatewayDeploymentDetailSchema,
+  GatewayDeploymentPingResponseSchema,
   GatewayDeploymentSchema,
+  GatewayDeploymentStatusSchema,
+  GatewayDeploymentTypeSchema,
+  GatewayDeploymentUpdateRequestSchema,
+  GatewayGlobalWorkspaceAccessInputSchema,
   GatewayGlobalWorkspaceAccessSchema,
   GatewayGroupRowSchema,
+  GatewayGuardrailActionsSchema,
+  GatewayGuardrailCheckSchema,
+  GatewayGuardrailCreateRequestSchema,
   GatewayGuardrailCreateResponseSchema,
   GatewayGuardrailDetailSchema,
   GatewayGuardrailSchema,
+  GatewayGuardrailUpdateRequestSchema,
+  GatewayHuggingFaceConfigurationSchema,
+  GatewayIntegrationCreateRequestSchema,
+  GatewayIntegrationModelUpdateSchema,
+  GatewayIntegrationModelsBulkUpdateRequestSchema,
   GatewayIntegrationModelsResponseSchema,
   GatewayIntegrationSchema,
+  GatewayIntegrationUpdateRequestSchema,
   GatewayIntegrationWorkspaceSchema,
+  GatewayIntegrationWorkspacesBulkUpdateRequestSchema,
   GatewayIntegrationWorkspacesResponseSchema,
+  GatewayJsonObjectSchema,
+  GatewayJsonValueSchema,
   GatewayLogRecordSchema,
   GatewayLogsResponseSchema,
+  GatewayMcpAuthTypeSchema,
+  GatewayMcpTransportSchema,
+  GatewayMutableMcpCapabilityTypeSchema,
+  GatewayOpenAIConfigurationSchema,
+  GatewayOrganisationAuthSettingsUpdateRequestSchema,
+  GatewayOrganisationUpdateRequestSchema,
+  GatewayPluginCreateRequestSchema,
   GatewayPluginSchema,
+  GatewayProviderCreateRequestSchema,
   GatewayProviderCreateResponseSchema,
+  GatewayProviderDetailSchema,
   GatewayProviderSchema,
+  GatewayProviderUpdateRequestSchema,
+  GatewayRateLimitInputSchema,
   GatewayRateLimitSchema,
+  GatewayRateLimitTypeSchema,
+  GatewayRateLimitUnitSchema,
+  GatewayRoutingCacheSchema,
+  GatewayRoutingConfigSchema,
+  GatewayRoutingRetrySchema,
+  GatewayRoutingStrategySchema,
+  GatewayRoutingTargetSchema,
+  GatewaySageMakerConfigurationSchema,
+  GatewaySecretMappingSchema,
+  GatewayServiceApiKeyCreateRequestSchema,
+  GatewayUsageLimitInputSchema,
   GatewayUsageLimitSchema,
+  GatewayUserApiKeyCreateRequestSchema,
+  GatewayVertexAIConfigurationSchema,
+  GatewayWorkersAIConfigurationSchema,
+  GatewayWorkspaceBindingSchema,
+  GatewayWorkspaceCreateRequestSchema,
   GatewayWorkspaceCreateResponseSchema,
   GatewayWorkspaceDetailSchema,
   GatewayWorkspaceSchema,
+  GatewayWorkspaceUpdateRequestSchema,
   GatewayWriteResponseSchema,
   GoalListResponseSchema,
   GoalSchema,
@@ -12745,6 +14058,7 @@ export {
   LanguageOptionSchema,
   LatencyChartResponseSchema,
   ListApiKeysResponseSchema,
+  ListConfigVersionsResponseSchema,
   ListConfigsResponseSchema,
   ListDeploymentsResponseSchema,
   ListGuardrailsResponseSchema,
@@ -12813,7 +14127,18 @@ export {
   MaskedDataSchema,
   McEntrySchema,
   McReportSchema,
+  McpIntegrationCapabilitiesBulkUpdateRequestSchema,
+  McpIntegrationCapabilitiesResponseSchema,
+  McpIntegrationCapabilitiesUpdateResponseSchema,
+  McpIntegrationCapabilitySchema,
+  McpIntegrationCapabilityUpdateSchema,
+  McpIntegrationCreateRequestSchema,
+  McpIntegrationDetailSchema,
+  McpIntegrationMetadataSchema,
   McpIntegrationSchema,
+  McpIntegrationUpdateRequestSchema,
+  McpIntegrationWorkspacesBulkUpdateRequestSchema,
+  McpIntegrationWorkspacesUpdateResponseSchema,
   MetadataCriterionSchema,
   MetadataSchema,
   ModelConfigurationSchema,
@@ -13056,6 +14381,7 @@ export {
   WebSocketConnectionParamsSchema,
   WeightedRegexSchema,
   aiGwOrganisationsAuthSettingsPath,
+  buildDottedObject,
   collectAll,
   collectSkipPages,
   collectSpringPages,
@@ -13064,6 +14390,8 @@ export {
   jsonNullable,
   pageSchema,
   paginate,
-  serializeListing
+  redactAIGatewaySecrets,
+  serializeListing,
+  setDottedValue
 };
 //# sourceMappingURL=index.js.map